Rick Cudworth and Helena Coe.
Q10 The Chair: Welcome, both of you. Thank you very much for sparing the time to come and help us with our inquiry into national resilience. I need to emphasise that this is a public session, taking oral evidence from you, and it is being broadcast live. There will be a transcript and you will be sent a copy of that transcript within the next couple of days or so. If there are any minor inaccuracies, then you will have an opportunity to correct the transcript then.
I would like to ask each of you to just introduce yourselves very briefly for the record in a couple of sentences, and then we have a number of questions that we would like to put to you. We have about an hour to do all that, if that is okay. Ms Coe, perhaps you would like to go first.
Helena Coe: Good morning, and thank you so much for having the CBI. I am a policy manager in the UK competitiveness team at the CBI. I sit on the policy floor, and I lead on defence, economic and national security, resilience and investment for the CBI.
Rick Cudworth: Good morning, and thank you as well for the opportunity to provide oral evidence. I am the board and executive director for Resilience First. Resilience First is a non-profit. We have around 3,000 organisations in our membership and about 5,000 resilience leaders that we engage with through our network. We also run the London Business Networks for Resilience, so there are about 46 business networks across London that are engaged in that network as well.
The Chair: Thank you very much. I will kick off with the first question to both of you, just to set the scene, really. Could each of you say what risks the private sector faces at the moment, including due to geopolitical tensions? How do these risks, and any existing resilience plans in place already, vary across key industries and sectors, such as finance, food, water, medicine, transport, and any other critical sectors you would like to name?
Helena Coe: The first thing is that the list of risks is ever-increasing. It goes without saying that the geopolitical environment is very unstable. It is only increasingly unstable, and companies are now seeing resilience as an operational necessity rather than a “nice to have”. I think that is the baseline.
I understand that you have picked out the key sectors around finance, food, water, medicine and transport. We would also, from our members, say that energy should be there. Energy is a risk but it is also a sector, and it is one of those interdependencies that underpins some of the national resilience that the UK faces. There is a whole list, so I am sure Rick will come in with some that I have missed. Broadly, for our membership, cyber, supply chains, climate, geopolitics—you have already mentioned that—energy, and people are the key risks that they see alongside economic and national security as well.
I would say that, between the risks, there are shared challenges. I have already mentioned interdependencies, and it is important to say that, for our members, the risks they see vary as much by business size as by sector. Although sector segmentation is useful, business size is also an important consideration when we are looking at resilience planning and functions around resilience, because boards at different levels have different capacities and capabilities.
Rick Cudworth: I would paint a bit of a picture first. I think that we have moved very rapidly in the changing risk landscape for businesses. They have been very good at and very used to dealing with what I would term discrete, often marginal, quite manageable risks, where the focus has been on how they prevent and control them and how they respond to them and recover from them. What we are seeing now is a very different world, where we have severe and, as we keep saying, interconnected risks. Some of these are potentially existential risks as well.
Key drivers to that for me and for the businesses that we work and communicate with are things like geostrategic shifts and geopolitics; climate change and the events that have been caused through that; digital, including cyber within that; and societal risks, in fact, everything from demographic shifts to misinformation. These are very different risks to historically how businesses have had to look at risks. To me, that means that it [businesses] is [are] perhaps too slow still [in adapting to this change]. Resilience needs to be a strategic imperative, and the language around it needs to move from a reactive position—about writing plans, training and exercising, response, recovery, which is all quite reactive—to fundamentally understanding that it is about strategy and business model. It is about the choices they make in terms of where they source products, how they source them, supply chain diversity, how much cash they hold, and so on. These are very different choices that affect the resilience of companies as we look forward.
The Chair: Thank you. Baroness Winterton has a follow-up question.
Baroness Winterton of Doncaster: I am particularly interested in the whole issue of misinformation and foreign interference in democratic processes. Obviously, a lot of that can be done digitally—the cyber world, and so on. The private sector must be constantly worried about cyberattacks, and we have seen the recent things that have an economic consequence. Presumably, they have to develop a relationship with the tech world in order to say, “We collectively have to take action to prevent this”, but there is a tension there. I wondered if you could describe whether those discussions take place, and whether the linkage between attacks on our democratic institutions through the cyber world has a read across to attacks in terms of the economic effects on Rolls-Royce, Marks and Spencer and so on.
Helena Coe: I think that an important point is that cyber incidents are a whole-economy disruption. They are not just seen as IT outages any more. You have mentioned some of the companies that were quite high profile last year. Importantly for our members, if there are cyber incidents, they immediately look to their supply chains and to their customers. I am afraid I cannot comment on democratic read across because that is not something that the CBI necessarily looks at. From a business perspective, they are looking at the core resilience gap often being in recovery and not the prevention of it. Some of these risks, as you say, come from foreign actors, and cyber is increasingly an international sphere. Our members know that and are looking at those risks through an international lens. Some of our members are multinationals so may be experiencing different cyber risks in different jurisdictions, and that is why intelligence sharing between businesses is crucial.
Digital dependency for the UK is quite high, but capability is really uneven. In terms of risk and impact, large firms worry about SME cyber maturity, but SMEs often report that they are victims of upstream failures, not causes. There is a bit of communication needed around—
Baroness Winterton of Doncaster: Pressure upwards on the—
Helena Coe: I think that pressure goes both ways, to be honest. From our membership, they would really benefit from clearer, more coherent and trust-based collaboration from government, so where government are identifying some of these risks. Members speak very highly of the NCSC, for example—the National Cyber Security Centre; sorry, there are lots of acronyms in the resilience world—but penetration is not necessarily where we would like to see it.
Rick Cudworth: We hear less about businesses talking directly about misinformation at the moment. It does happen, but it is not necessarily the biggest part. Certainly, cyber threat and cyber risk is a big discussion point, and there is a lot of activity, particularly in larger businesses, on that. As Helena said, smaller businesses possibly often see themselves as perhaps the downstream victim in the supply chain rather than necessarily the direct targets of cyberattacks.
Expanding on it a little bit, there is a whole theme around digital resilience overall. Cyberattacks are one element of that. There are other elements. One of the things I want to say about this is there are many risks, but we are seeing increasingly a few very common consequences, like failure of digital services and disruption to supply. These are the things that actually happen, but when you look at it, there are multiple risks that could cause those. These are the consequences, which are a real focus for businesses and a real worry for businesses as we go forward.
Q11 Baroness Northover: You have touched upon part of this question already. The question now becomes: what are the implications of the interconnectedness between national and international risks? What does that imply for UK preparedness? How should these risks be monitored so that escalation is identified quickly? What forward thinking is therefore required? I will go to Mr Cudworth first.
Rick Cudworth: If you think about the international connectedness and digital resilience and you think about some of the risks, where there is a lot of talk around undersea cables and the geopolitical shifts, we see more businesses now talking about operational sovereignty and what that might mean and how they achieve it. These are all indicators of that international picture. I think it can be dangerous, as the UK, simply to think we are an island and we manage these risks within the UK. Take the undersea cables. We are the primary loop between the US and Europe, so if they are cut it also impacts Europe. If it impacts Europe, that affects our food supply, for example. There are knock-on consequences that you get from many of these risks. We do need to look at some of these risks internationally and try to work with our partners internationally to address some of these risks from a resilience perspective.
Helena Coe: I would very much agree. I think that the national and international are increasingly seen as one for a lot of our members. You do not necessarily see national borders in risk and resilience, because resilience is a whole of society, whole economy question. The risk environment internationally is also shifting very rapidly, and risk tolerance is shifting alongside that. I would say that in terms of UK preparedness, I do not think information sharing and intelligence sharing should be overstated as to how important they are, both between Governments—Rick has already mentioned some of the international partners that we have—but also between businesses that operate in similar sectors.
Speaking to some of our members in critical national infrastructure, for example, they are constantly doing intelligence sharing with international counterparts. The risks might not be the same but plans might be similar, or early detection of risks might come from that communication. It is important that those multinational companies feel like they can talk about resilience across their individual business areas and that there is a true feedback loop between both business and government communications, while also hearing what Governments are saying to each other.
This leads on to a point around preparedness and monitoring so that escalation can be identified. We do not necessarily have a definition of resilience that works across those partners. I do not think that the UK Government necessarily have a full resilience definition. That leaves a traction and momentum problem for some of our members because they want to engage. They want to be resilient, but resilience can mean different things to different people. In terms of preparedness, a definition is a great starting place. We were supportive of the resilience action plan. We have been doing lots of engagement with the COBR Directorate and other teams across government. However, awareness is still relatively low, or lower than we would like it to be. I suppose that is taking your point that, yes, it is very interconnected, but preparedness also needs to start from somewhere.
The Chair: This is obviously a very important question because we have two quick supplementaries to it. Perhaps we could hear both questions first, and then you could answer both together. First of all, I will call Baroness Mobarik, and then Baroness Curran.
Baroness Mobarik: Thank you very much. Very quickly, business models have been basically based on efficiency and profitability and globalised supply chains for goods that are essential to resilience. Since Covid and the war in Ukraine, to what extent has the UK moved away from a purely just-in-time economic model towards one that involves strategic reserves and supply chain resilience for essential goods? Has the private sector bought into that?
The Chair: Baroness Curran, did you want to ask your question now?
Baroness Curran: Very briefly, if the international aspect is becoming more important, what is the architecture for engagement? How do we engage with other countries? Do we need to modernise our systems?
The Chair: Okay. Helena, would you like to go first?
Helena Coe: Yes, I will touch on the architecture first, because I think that there is some good architecture that already happens between Governments. Some of the communication around that probably could be better, around who the UK Government are talking to and what they are talking to them about. We are supportive of some of those multilateral/bilateral engagements. I think that it just comes back to that feedback loop. Businesses are not—
Baroness Curran: They are not decision-making forums; it is just engagement.
Helena Coe: Exactly, but sometimes knowledge of engagement is as important as the decisions that are made.
Then, very briefly on the supply chain, interconnectedness, just-in-time point, the short answer is yes. Businesses have moved away from that where they can, but cost pressures and margins sometimes do not allow that to happen. Businesses are looking very much at structural fragilities more and more, whether that is tariffs and how those change global supply chain reconfigurations or whether that is high interest rates or squeezed margins. Different sectors are impacted differently. Chemicals, for example, comes to mind as a sector that is increasingly negatively impacted. Some of the challenges that can be seen in that sector around site closures and so on mean that we are potentially less prepared now than we were pre-Ukraine and so on. I understand time pressures, so I will pause.
The Chair: Mr Cudworth, do you want to add to that?
Rick Cudworth: Yes, I will pick up on the strategic reserves because this is a key point I made right at the start about the changing risks.
Yes, businesses have been gradually changing some of their supply chains and increasing diversity and so on, but I do not necessarily think that they have explicitly thought of that as resilience. They have thought of that as just an adjustment to the way they need to operate. This is where I am coming from about changing the language. If we keep talking about resilience as purely about writing plans, exercising and response, it is very reactive, whereas we need to move the language to building capacity, to strengthening organisations, to strengthening the UK and avoiding fragility. To do that, then you move into how much stock should we hold; how diverse should our supply chains be; where should we source from? These are then strategic questions for businesses to address. That is my point about addressing it as strategy and business model. We are only just starting that journey, but the language we use does not always help organisations see it in that way.
The Chair: Are you saying we should have another word other than resilience or change the meaning of resilience?
Rick Cudworth: I think that we should change the meaning of resilience. There is a definition in international standards for organisations, and it has three words: “anticipate”, which is about understanding the risks and the nature of those risks and how it would impact, but then it talks about “absorb”. Very few people think about the absorptive capacity, which is about how much cash we hold, how much stock we have, diversity of supply chains. All those things are about being able to absorb impacts so they have less effect when they happen. Then it talks about being able to “adapt”, which is being able to change and adapt as a result. There is a clear definition, but it is about the language that we then use around it, which is typically a reactive language on recovery and response.
Q12 Lord Oates: I should first declare my interest as chief executive of not-for-profit United Against Malnutrition & Hunger. In the previous session, we heard from the LGA that there was a growing gap, they felt, between public and private sectors, certainly at a local level. I wondered if you could tell us how you think the private sector could collaborate more closely with government—nationally, locally, regionally—on preparedness and resilience, including to address information gaps within organisations and to facilitate access to the latest technology. Maybe I could start with Ms Coe.
Helena Coe: The first point is that a lot of the resilience messaging needs to come from government if it is preparedness messaging. Our members are very willing to distribute some of that messaging, but that really needs to come from the top. For example, in the CNI space— critical national infrastructure—they have ways of putting that messaging out there, but in order to ensure consistency across providers, that really needs to come from the top. I will not necessarily be able to comment on the local angles because the CBI looks at resilience very much from a national perspective, but we do work across all regions and nations of the UK.
I think that some of the changes in structures have not helped. I know those were touched on in the previous session. The importance around communication is clarity and consistency. It is something that we speak about a lot across different policy areas, but it is even more relevant in an area such as resilience, where there are so many different angles to it. On the tech and innovation challenges, I think that comes back down to people as well.
There are great advantages to some of the technological changes, but at the same time that adds extra impacts on the people who are working within those businesses to adapt, change and develop. They need support in order to be able to do that.
I feel like I have another point but my train of thought has just gone, so I will pause there, sorry.
The Chair: We can come back to that later, then, if you remember it. Mr Cudworth.
Rick Cudworth: On the private sector/government collaboration, I do think here it is not just the fault of the private sector not engaging. In my experience, government are very quick to go from national government to local government and then trying to communicate to the public, or they are just starting that, but they are missing out a complete layer, which is business. If I think about it, there is a shared interest. Government and business both have a shared interest in a safe, stable and investable UK, which is a key element of resilience. There is also a mutual interest, from a business perspective, in terms of improving the resilience of the public and people at home, bearing in mind that an awful lot of the public are the workforce of business. Therefore, there is that mutual shared interest, because if people are not prepared at home, they will not be willing or able to come to work when they are needed in a severe event. So, that mutual interest is also there.
Therefore, there is an opportunity for government to use business far more widely as an important lever to improving public resilience, as well as encouraging businesses to take responsibility for their own resilience, beyond just having plans and recovery, as I have said, thinking more strategically about resilience.
Baroness Winterton of Doncaster: I have a quick follow-up, and it plays a little bit into the next question as well about regulatory and governance measures. Going back to this issue of misinformation, yesterday we had a presentation here about fat jabs and fake advertising and scams that take place on the internet, and it was about how to spot these. This is the same as misinformation about democracy and trying to influence elections. I do feel that there is that crossover in terms of collaboration with government, because businesses are affected by some of this fake stuff that is put out. I wondered if you might comment on that.
Rick Cudworth: As I said at the outset, we are not hearing businesses talking quite so much about misinformation. I am not saying that it is not happening at all. We certainly have members, and you mentioned, say, the advertising industry, where actually it is a big issue for them. However, more widely than that, we have not picked that up. We are definitely picking up concerns about hybrid war and operational sovereignty. Hybrid war would probably include aspects of misinformation in the thinking there. [But] they is [are] also thinking about other aspects that might go on that disrupt supplies, energy, water systems and so on.
The Chair: Lord Oates, did you want to come back on your question?
Lord Oates: I have a quick question. Reference was made previously to the Prepare website. It does not seem obvious, just taking a look at it, how well designed it is for business and so on. Does business have much involvement or much awareness of the Prepare website, and has it much engaged in it, in your knowledge, Mr Cudworth?
Rick Cudworth: It is not, although we do engage the COBR Directorate. It has briefed our members on the site, so that activity happens. It is aimed at the public—absolutely right—not at business directly. This is where I think one of the opportunities is. Government can encourage businesses to train their workforce about being resilient at home, about the UK Prepare website. If you can get 50% of the public engaged through that route, and it is in the businesses’ interest that their workforce is engaged in that way, then we might move more quickly on it.
Helena Coe: We have pushed out various communications around the Prepare website to our members as part of our general communications. Government departments often ask us to talk to our members about certain things, and the Prepare website was one of them, around the launch of the resilience action plan. The important part there is that businesses, as Rick said, are made up of people. The more you can encourage people to look at the resources that are available, the better, taking learnings from international examples as well. For businesses that operate multinationally, different nations have different levels of preparedness, and we are finding some of our businesses are talking to each other about how they are feeling about preparedness in other nations. The Nordic countries, for example, often come up quite highly as those that are able to talk to their communities and their people really well, and people have a better understanding of their own personal responsibilities in that space.
Yes, I would say that the awareness is not as high as we would like, but I think that is similar to other government initiatives like the national risk register, for example.
Q13 Lord Marland: I declare that I am an owner of several SMEs, which are in the House of Lords register. I would observe and agree with many of the things you have said—that multinationals are pretty prepared for this and they have resilience planning. SMEs on the whole do not or have not. Certainly, very few of the ones I am involved in have planned for any form of resilience. This means that the language is not filtering down into the roots of business, which seems to me a problem. I am not in favour of regulation, but do you think there is some form of regulation or governance that we should be bringing in to impose this resilience on businesses, particularly the SMEs?
Helena Coe: I am happy to go first on this one. It is important for our members that regulatory compliance should not be seen as the be-all and end-all for resilience because regulatory compliance does not always equal resilience. Especially in the critical national infrastructure space, resilience is as much about reliability for the regulator as it is about true resilience. The definition of resilience across different sectors is different depending on which regulator you sit under. That is the first point. We should not rely on regulation to enforce resilience, especially for those who necessarily have not thought about it like that before.
It is important to have that shared learning between those who are already in regulated sectors and those who are in unregulated sectors. SMEs will fall into both camps, so it is not necessarily something ground-breaking there. Especially as resilience rises up the agenda, regulated industries will do certain things that could be shared down their supply chains. Equally, that feedback loop is important.
Then the final point I want to make on this is specifically around cyber resilience, which does impact SMEs, probably proportionally more. Good governance should require cyber resilience, but it should not just be a reliance on insurance. Speaking to some of our members, some insurance schemes have been well regarded; Pool Re and Flood Re, for example. Insurance should not be seen as the be-all and end-all of resilience so we should look at what good governance means more broadly.
Rick Cudworth: Yes. To add, I agree fully with Helena. We should not regulate small businesses across the board here. We definitely see a difference in the regulated industries and how regulators approach resilience. The financial services regulators are substantially more active in the regulation and oversight of resilience of financial institutions than other regulators have been—and probably still are today—on regulated sectors, say water, energy and so on. There is a difference there and other regulators would benefit from raising the bar in line with the financial regulators. Alongside that—
Lord Marland: Sorry, I am coming back to you because I think I know what you will say now. Is there a handbook or guidance to SMEs as to what governance they should adopt to protect themselves for resilience if regulation is not the answer?
Helena Coe: We do not have a position on that as the CBI.
Lord Marland: Surely this could be a useful tool for SMEs.
Helena Coe: Yes.
Rick Cudworth: To answer that, for the regulated industries, again, if you apply the financial services [approach]thing where they then look at critical third parties to those industries, they come under regulatory guidance or supervision now as well. The other industries could follow that. That would get to some small businesses that are in the supply chain for essential services in the UK. That is perhaps how to get a [apply] regulation over some small businesses.
In terms of guidance, yes, there is. Our London Business Networks for Resilience, which is targeting small and medium businesses, points out that there is currently a lack of either toolkits or guidance that support them. I do question for some small and medium businesses, again, whether it is as much about thinking about stockholding, cash holding and so on as it is about writing plans. There is probably a change in the language or how they think about it as well in terms of being resilient.
Q14 Lord Oates: Could I come back specifically on this issue around the financial services industry? It has capital adequacy rules that apply according to different levels of risk. Does a stockpile adequacy requirement have a role, particularly in critical industries? For example, we heard about the water industry not being able to deliver bottled water. Could we apply learnings from the financial services industry more broadly?
Rick Cudworth: Yes, absolutely. The capital adequacy and liquidity ratios are for financial resilience. The financial regulators have then introduced a similar regime for operational resilience. Again, they do not want banks to exceed impact thresholds. They need to decide what those are. They need to stress test resilience regularly and report annually to the board around their resilience and ability to stay within those impact thresholds. Those are not for everything a bank or insurance company does, but about the essential things it does for the country or for its customers, making payments and that sort of thing. There are real learnings [we can take from this] about how we approach it [resilience].
The Chair: We have follow-up questions from Baroness Curran and Lord Farmer.
Baroness Curran: I will be brief. Where does support become regulation? It is quite interesting, because we have a responsibility to think about how we advise key stakeholders, with businesses of all sizes being part of that, to see coming risks and coming challenges down the line. People need to be encouraged to do that. There is quite a lot of work that could be done on that. It is interesting.
Are you saying that the current regulators that we have need to improve their game in terms of resilience and have to make recommendations to their partners, for example, in water, and that we should be encouraging them to be more specific about recommendations and requirements that they have? Also, should we be saying to the private sector, “You need to think about and you must prepare for things”, even if we do not want to make draconian regulation but we do have to give them guidance and support? I will call it support.
Helena Coe: Yes, on the guidance and support piece.
Baroness Curran: Make them hear it, I suppose, is what I am saying.
Helena Coe: Exactly. That is the role of organisations like the CBI and like Resilience First. We can communicate to our members about the importance, but we need to have that strong, clear messaging coming from the Government.
For us, we know that we need to encourage private sector investment in resilience because there is a higher cost to the taxpayer if that is not found. Again, it varies so much across sectors and where they are. It is hard for us to specifically make recommendations in this space at the moment.
Baroness Curran: Why is it hard to make recommendations for that space?
Helena Coe: Because where people are on different parts of the journey, even within a sector, I cannot say, for example, “This sector has this gap in resilience” or, “This sector has that gap in resilience”, because the sectors are made up of businesses of all sizes. They operate in all areas of the UK. They operate abroad. As we heard from the previous session, public awareness is different in different sectors. That is the same for business awareness as well.
The point on the regulators is that engagement is important for our members, whether that is engagement between business and regulators or whether that is engagement from the Government to regulators. It is important that if our standards are developed, international standards exist and British standards exist, and resilience does not just become about reliability. As I have already said, in the critical national infrastructure energy space, resilience is about reliability and it is a narrow definition, which means that our members are talking to their regulators about what resilience means to them and are looking at planning, but they are constrained at the moment by a narrow definition.
The Chair: Do you have anything to add to that one?
Rick Cudworth: I have a little bit. I will touch on again the financial side, where they do require that a critical service or an important service looks at the supply chain for that service as well and makes sure the critical suppliers in that are resilient. That inherently comes under regulation. That approach should be adopted more widely.
In terms of other guidance, of course, we have the national risk register but it is not widely used. One challenge here is that a lot of risks are listed in that risk register. As I have said before, if you boil it down, many of those risks have a common consequence, which is disruptions in supply, disruptions in energy, and so on. If we narrow it down to the actual disruptions, that might be easier for businesses to absorb and deal with.
The Chair: Thank you. Lord Farmer, you had a supplementary and yours is the next question as well. Do they go together?
Lord Farmer: No.
The Chair: Ask your supplementary first, then.
Lord Farmer: Regulatory and government measures have a history of being bureaucratic and rather overbearing and delaying things. In this area of resilience we need quick action. How can regulation and governance measures be prevented from being bureaucratic and overbearing and delaying?
Rick Cudworth: From my perspective, there are a couple of things. We can learn a lot from how the financial sector regulators have already applied it, and we can copy and paste that effectively. That focuses on critical national infrastructure and essential services, and that is probably where it should focus.
Beyond that, it is a language and a communications effort because other businesses outside that need to be clear that they are accountable and responsible for their own resilience, but this is in their interest. It is about building a strong and healthy business at the end of the day.
Helena Coe: I do not want to be flippant, but engagement is the answer—regular engagement between business, the Government and regulators so that things are not developed in a vacuum and that development has a feedback loop. However fast that might be, engagement is needed before things are put into place. The role of organisations like the CBI is to provide that quick feedback and engagement mechanism so that things do not get bogged down in bureaucracy and overly complicated governance.
The Chair: Thank you. The last supplementary, Baroness Mobarik.
Baroness Mobarik: Quickly, what guidance is being given to SMEs about data protection? That is almost one of the biggest threats. It can bring a business to a complete halt. The goalposts are constantly changing in terms of what malign actors can do. Are you able to keep members apprised of new tools to stay ahead of that?
Rick Cudworth: I am less aware of guidance to SMEs on data protection. We do pick up, certainly in larger companies, for example, that while data protection is important, it is now less of an issue than things like ransomware attacks and so on, which stop their systems from working, as we saw with JLR, for example.
Baroness Mobarik: I know of a number of small businesses that have been impacted so badly and have come to a halt over a number of months trying to get their data back. SMEs are vulnerable to this.
Helena Coe: I cannot comment specifically on the SME and data protection side either, but our members are focusing on where those SMEs can go to find trusted guidance. Often they are turning to those providers that already provide them with services. Again, it goes back to the communication point. If things like that are available, are we letting our banks, for example, know of them so that they can direct their clients to them? Unfortunately, that is all I have to say on that.
Rick Cudworth: I would add that the remit for the London Business Networks for Resilience that I mentioned, which was started by the Greater London Authority so is under the auspices of the Greater London Authority’s Resilience Unit, includes providing tools, guidance and information for small-medium businesses. A website was set up. This is part of a trailblazer programme. London is leading the way on it, but others may follow. That is trying to get small businesses in local areas much more engaged around the topic of resilience, and having the tools and the guidance you are talking about in place.
The Chair: Thank you. That partly connects with your question, Lord Farmer.
Q15 Lord Farmer: I should declare my interest as a director of a non-profit organisation, the Family Hubs Network Ltd. The Government’s resilience action plan gives its second objective as to “Enable the whole of society to take action to increase their resilience”, and it gives various points that it recommends, one of them being “Better integrating the offer from … community and faith services”. How would you say you should build a whole of society approach in practice? What are the roles of national government, local resilience forums, businesses and communities? What needs to change?
Rick Cudworth: If I could pick that up, I will come back to the London Business Networks for Resilience because that is part of a group of partners [to GLA’s London Resilience Unit], including communities, faith groups, volunteer groups and so on. The specific aim is to connect the business networks and therefore small and medium businesses to borough resilience forums.
It surprised me, when we picked this up, how few business networks and small businesses even knew that London has borough resilience forums. That will replicate itself right around the country. Businesses are either not fully aware or not directly engaged with their local resilience forums. To me, it is a big gap. As I have said before, business is a huge lever that we are not using currently to build national whole of society resilience.
Helena Coe: I would like to make a couple of additional points on that whole of society approach. We think about this very much at the CBI because, for us, resilience and growth are two sides of the same coin. If you do not have a whole of society approach to resilience, you will not have growth. We also sit on the panel of commission members of the National Preparedness Commission, and we are looking at that with them as well.
It was great that the resilience action plan set that out as a recommendation but, in practice, communication needs to start earlier. I have had members suggest to me that it should start at school, for example. They had been speaking to their children about resilience because resilience plays a big part of their day job. Their children do not have the tools to be able to understand some of those conversations. Again, that goes back to the point about resilience meaning different things to different people, different organisations, different parts of the UK.
Yes, we are looking at it. We do not have a clear answer for you at this point.
Q16 Lord Peach: Briefly, if we go back to your reactive/proactive discussion, in this context am I pushing you too hard to say that we may be having two separate conversations between the public sector and the Government and the private sector? The private sector, particularly the larger businesses, has an awareness of the world risks, geopolitical risks, geo-economic risks and so on. You correctly mentioned the risk we face to information around our undersea cables. Then there is a national conversation internally much more about climate and environment and local risk. I am asking in the context of this session how those two connect. I am asking myself as much as you.
Rick Cudworth: You make a good point. There is that disconnect. Quite a lot of, I suspect, the more local community risks are focused on things that would happen within the local community directly, like floods or other weather events, whereas big businesses are more worried about the risks we have talked about.
The Chair: Do you have any thoughts, Ms Coe?
Helena Coe: Yes. To add to that, yes, there are probably some disconnects but it is maybe because not the word “resilience” but certainly the concept is being talked about more in spaces where both sectors exist. Businesses are made up of people as well. Companies also have that internal feedback loop because they all listen to what their customers and employees are saying as well.
It is important that our members no longer see resilience as such a narrow scope. In climate, for example, although flood risk might be a community-based risk, it also impacts those businesses that are in that space and the people who work there or the people who buy from them, for example. You cannot necessarily distinguish those two elements completely, but they are probably looking at it from slightly different angles.
Q17 The Chair: I do not know if my final question will be more or less difficult for you to answer, but it is this. It is this committee’s job at the end of the inquiry to come up with some recommendations to the Government. What one most important recommendation would you advise us to make on preparedness and resilience? What would be at the top of your wish list for recommendations to the Government?
Helena Coe: I am happy to go first. I have spoken a lot about communication in this session. My one recommendation would be to have as honest and open a dialogue as possible with proper business engagement, not just last minute but thought through, with a proper feedback loop, using the willingness and talent that exists within the private sector, but also for the Government to be clear about what resilience and preparedness mean and the expectations from the Government to the private sector so that the private sector can prepare and be as resilient as possible. It is about having a spirit of true partnership on this topic.
Rick Cudworth: Similarly to that, I would say engage the private sector, see it as an important lever to the whole of society approach to resilience. In that engagement, not only use the right language in terms of being strong and healthy, but encourage businesses to prepare their employees better at home as part of their workforce training. Encourage businesses to support community resilience and take responsibility as businesses for their own resilience. That is the message I would try to get across.
The Chair: Thank you. Baroness Hunter wants to press you even further.
Baroness Hunter of Auchenreoch: On this communications thing, I remember at university a billion years ago doing mass mobilisation, total war, Picture Post, “In Which We Serve” and all that. I know it is, of course, completely different now, but how will you get everybody involved in this? How will you communicate to everybody? Are you talking about the Scandinavian model? You were talking about children specifically.
Helena Coe: The Scandinavian model has been raised by some of our members. It is as important to have everyone in the tent as it is to have those in the tent who can communicate to as many people as possible. It is about the multiplier effect in communications. You will never be able to hit everybody, but it is about trying to maximise the engagement that you can have. For example, the CBI engages across a range of topics that we can then communicate to our members, whether in this space or in other policy spaces. Our members can talk to their clients. Our members can then talk to their customers. It is, I suppose, about that multiplier effect and not getting hung up on talking to everybody at the same time. It is about making sure that the messaging can flow out as quickly and as sensibly as possible.
The Chair: The tiniest last word, Baroness Winterton.
Baroness Winterton of Doncaster: The tiniest, maybe to take away. Do you have an example of the best way you have seen the Government engaging? If we are to make a recommendation, is there an example where it has been done well that could be copied? That may be to take away and come back.
Rick Cudworth: If I can say one thing, there is the national level including regulators, but there is also the local level and local authorities and local resilience forums, more actively engaging, perhaps looking at the model that London has adopted with London business networks to get small businesses involved. It is multiple efforts, but it cannot just be national. You have to go local as well.
Helena Coe: The quick example for me is a pertinent example at the moment. We are working with the economic security team at the Department for Business and Trade on its Economic Security Advisory Service, and some of the feedback loops that are happening as that develops are probably something to look at.
Baroness Winterton of Doncaster: That is helpful. Thank you.
The Chair: That is a positive note to end on. Thank you both very much indeed. That has been a helpful session. I can now close the public session. Thank you.